SqlExecutorMCP

Python MCP SQL Server MySQL License: MIT

An MCP server that lets AI agents work with real databases without handing them the keys to the kingdom. It speaks to SQL Server and MySQL over named connections, and every request passes through an allowlist and a statement-type gate before it touches an engine.

I built it because I point Claude at working databases every day, and "the agent can run whatever SQL it wants" was never going to fly. It's wired into my own Claude Code sessions as I type this.

The safety model

This is the part I care about. Three layers, all enforced server-side:

1. Named connections only. The agent never sees a connection string. It asks for a connection by name, and credentials live in a local config.json that never leaves the machine.
2. Per-connection allowlists. Each connection declares which databases and schemas are fair game ("*" is available, but it's an explicit opt-in). Anything outside the list raises a permission error before any SQL runs.
3. Statement-type gating. Every statement is parsed with sqlparse and its type is checked against the tool that submitted it:
   • execute_query accepts SELECT and CALL, nothing else
   • execute_statement accepts INSERT, UPDATE, CREATE, ALTER, and MERGE
   • DELETE and DROP each require their own dedicated tool, so a destructive statement can't ride in on a generic call
   • TRUNCATE is blocked everywhere, full stop

Transactions get the same treatment: execute_transaction runs a batch of DML atomically, and the MySQL adapter knows that DDL there commits implicitly, so it won't pretend a DDL rollback would have worked.

Tools

Setup

pip install -e .
cp config.template.json config.json   # connections + allowlist, see the template

Then register it with your MCP client (Claude Code / Claude Desktop shown):

{
  "mcpServers": {
    "sql-executor": { "command": "sql-executor-mcp" }
  }
}

Stack

Python 3.10+ · FastMCP · pyodbc · mysql-connector-python · sqlparse